Rails Azure Active Directory SSO with Web + iOS App Authentication

Since I've been asked for some deeper insight into this, I'll go ahead and post the solution I ended up implementing.

Add this to your gemfile:

gem 'omniauth-microsoft_v2_auth'

Add this to the bottom of your config/devise.rb file:

config.omniauth :microsoft_v2_auth, ENV['CLIENT_ID'], ENV['CLIENT_SECRET']

You'll have to add those environment variables to your environment. I typically use the Figaro gem while in development and then set them via Heroku CLI when deployed.

You'll need to route users to your Azure authentication via sessions controller. Add this to your routes.rb file:

devise_for :users, :controllers => {sessions: 'sessions', registrations: 'registrations', omniauth_callbacks: "callbacks"} 

devise_scope :user do
  post 'users/sign_in_with_azad_token' => 'sessions#sign_in_with_azad_token'
end

Here's how I implement the action in my sessions controller:

def sign_in_with_azad_token
    token = params[:token]

    # Use the graph API to ensure this user is legit
    uri = URI("https://graph.microsoft.com/v1.0/me/")
    request = Net::HTTP::Get.new(uri.request_uri)
    request['authorization'] = "Bearer #{token}"

    response = Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https') do |http|
        http.request(request)
    end

    json = JSON.parse(response.body)

    if json["error"].nil?
        # If no error, user was found
        user = User.from_uid_email(json["id"], json["userPrincipalName"])
        unless user.nil?
            sign_in("user", user)
            respond_to do |format|  
                format.json {  return render :json => {  :success => true, :user => user } }  
            end
        else
            respond_to do |format|  
                format.json {  return render :json => {  :success => false, :message => "You must sign in before continuing" }, status: :unauthorized }  
            end
        end

    else
        respond_to do |format|  
            format.json {  return render :json => {  :success => false, :message => json["error"]["message"]}, status: :unauthorized }  
        end
    end

end

You may want to have a way to allow your users to authenticate using Microsoft Azure in the webi browser. In that case you'll need to add this to your Devise new registrations view (mine is located in views/devise/registrations/new.html.erb and views/devise/shared/_links.html.erb):

    <%- if devise_mapping.omniauthable? %>
      <%- resource_class.omniauth_providers.each do |provider| %>
        <%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider) %><br />
      <% end -%>
    <% end -%>

Finally, the endpoint where my client app performs its login is at ...[server_url]/users/sign_in_with_azad_token.json

I hit this endpoint after I've authenticated using the MSAL iOS framework on the app side and obtained the token. I include the token in a JSON payload that is part of the request body. The payload is simply:

{
    "token" : "dj9hs0shgkshd93hs92bh7493"

}

Hope this helps. It's been a while since I've worked on this, so I may have forgotten something. Add a comment to this answer if anything seems missing.